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Top Stories 

• An October 1 fire at Deerfield Farms in Moore County, North Carolina, caused an 
estimated $600,000 in damage to a nursery building and killed 4,200 hogs worth about 
$400,000. - WRAL 5 Raleigh (See item 9) 

• Cedars-Sinai Medical Center in Los Angeles notified 33,136 patients September 1 1 that 
their personal and health information may have been accessed after an employee laptop 
was stolen in June, an increase from the hospital’s initial report in August that the theft 
affected 500 patients. - Los Angeles Times (See item 16 ) 

• Three executives pleaded guilty October 1 in a bribery scheme to grant U.S. National 
Guard contracts incorrectly by bribing National Guard officials with money to award them 
marketing and advertising contracts worth $14.6 million. - Reuters (See item 19 ) 

• An October 1 power outage at the Rochdale Village housing complex in New York City 
stranded about 80 people in elevators and on construction scaffolding, and prompted an 
evacuation of residents from about 20 buildings. - WCBS 2 New York City (See item 35 ) 
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Energy Sector 



1. October 1, U.S. Environmental Protection Agency - (Kentucky) EPA reaches Clean 
Water Act settlement with two coal companies to improve water quality in eastern 
Kentucky. The U.S. Environmental Protection Agency (EPA) reached a settlement 
with Appolo Fuels, Inc., October 1 to pay $135,000 in penalties and ordered the 
company to remediate impacts to waters in the U.S. through on-site restoration and 
after-the-fact permit authorization for violating the Clean Water Act at its Jellico 
Surface Mine #1 in Bell County. Coal Operators 1, LLC also reached a settlement with 
the EPA to pay $110,000 in penalties after receiving 7 violations of the Clean Water 
Act at its Coal Essence Preparation Plant in Pikeville. 

Source: http://vosemite.epa.gov/OPA/ADMPRESS.NSF/d0cf6618525a9efb85257359Q 
03fb69d/b90b0db29878fb7e85257d64005006f7 



For additional stories, see items 3 and 12 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

2. October 1, Associated Press - (Louisiana; Georgia; South Carolina) Nuke supplier 
agrees to changes after cheating. Chicago Bridge & Iron Co. (CBI) agreed to a 
settlement with the U.S. Nuclear Regulatory Commission (NRC) to strengthen 
protections against worker misconduct after the NRC found that CBI employees at a 
facility in Louisiana cheated on welding exams and other qualification tests. The plant 
manufactures parts used in two nuclear power plants under construction in Georgia and 
South Carolina and the NRC found that no defective parts were shipped due to the 
misconduct. 

Source: http://chronicle.augusta.com/latest-news/2Q14-10-01/nuke-supplier-agrees- 
changes-after-cheating 
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Critical Manufacturing Sector 

3. October 1, Threatpost - (International) Schneider Electric fixes remotely exploitable 
flaw in 22 different products. The Industrial Control Systems Cyber Emergency 
Response Team (ICS-CERT) issued an advisory to operators of 22 different Schneider 
Electric industrial control systems products after a researcher identified a remotely 
exploitable directory traversal vulnerability that could allow attackers to bypass Web 
server authentication and gain administrator access and control over devices. Schneider 
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Electric released a firmware update to close the vulnerability in the products deployed 
in the manufacturing, energy, water, communications, and other sectors. 

Source: http://threatpost.com/schneider-electric-fixes-remotelv-exploitable-flaw-in-22- 
different-products 
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Defense Industrial Base Sector 

Nothing to report 



[ Return to top ] 



Financial Services Sector 

4. October 1, Las Vegas Review -Journal - (Nevada; Florida; South Dakota) Ex-LV 
chiropractor arrested in $34M fraud scheme. A former chiropractor in Las Vegas 
was arrested by FBI agents for allegedly working with a South Dakota man to funnel 
money from a Florida-based hedge fund that caused the fund to go bankrupt and led to 
millions in investor losses. The charges against the two men stem from 2010 U.S. 
Securities and Exchange Commission charges against the two men and six others, with 
federal prosecutors seeking to recover $44.8 million from the Las Vegas and South 
Dakota defendants. 

Source: http://www.reviewiournal.com/news/las-vegas/ex-lv-chiropractor-arrested- 
34m-fraud- scheme 



For another story, see item 33 
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Transportation Systems Sector 

5. October 2, KSHB 41 Kansas City - (Missouri) Power outage shuts down airport 
website, kiosks. A 3-hour power outage at the Kansas City International Airport 
management building shut down the airport’s Web site, arrival and departure signs 
inside the terminals, and wireless Internet access for almost 7 hours October 2. Power 
was still on in the terminal buildings and had no other effects on travelers. 

Source: http://www.kshb.com/news/local-news/power-outage-shuts-down-airport- 
website -kiosks 

6. September 30, Des Moines Register - (Iowa) 1-35 reopens after Tuesday morning 
crash. A portion of Interstate 35 in West Des Moines reopened to traffic after being 
closed for nearly 9 hours September 30 when the driver of a semi-truck lost control, 
crashed into construction barriers, overturned and spilled fuel onto the roadway, and 
caused a chain reaction involving a second semi-truck and two passenger vehicles. 
Three people were injured and taken to nearby hospitals with non-life threatening 
injuries. 
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Source: http://www.desmoinesregister.com/story/news/local/2014/09/30/seirLi-rollover- 
i-35/16473729/ 



7. September 30, WTAW Newstalk Radio 1620 AM - (Texas) Semi hauling chickens tips 
over in West Bryan. A semi-truck hauling approximately 5,500 live chickens 
overturned at the intersection of Highway 21 and FM 2818 in Bryan, Texas, September 
30 prompting the closure of the roadway for 2 hours as crews worked to clean up the 
incident. It was unclear how many chickens were injured or died as a result of the 
accident. 

Source: http://wtaw.com/2014/09/30/semi-hauling-chickens-tips-west-bryan/ 

8. September 30, WKYC 3 Cleveland - (Ohio) Four people hurt in Geauga County 
crash. Four people were injured when a vehicle traveling eastbound on State Route 87 
in Newbury Township lost control, crossed the center line, and struck an oncoming 
dump truck that resulted in a fire due to leaking fuel. The roadway was closed for about 
4 hours while crews investigated and worked to clean up the scene. 

Source: http://www.wkvc.com/storv/news/local/geauga-countv/2014/09/30/iniuries- 
reported- from- truck-crash-in-newbury/1 6480865/ 
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Food and Agriculture Sector 

9. October 2, WRAL 5 Raleigh - (North Carolina) Fire at Moore County farm kills 
4,200 hogs. A fire that broke out October 1 in a nursery building of Deerfield Farms in 
Moore County destroyed the structure and killed 4,200 hogs worth about $400,000. 
Officials estimated that the building sustained about $600,000 in damage. 

Source: http://www.wral.com/4-200-hogs-killed-in-fire-at-moore-county- 
farm/14036325/ 

10. October 1, U.S. Food and Drug Administration - (National) IKEA recalls Pastaalgar 
Fullkorn and Pastaalgar, due to non-declared soy content. The U.S. Food and Drug 
Administration announced October 1 that Ikea issued a recall for its Pastaalgar Fullkorn 
and Pastaalgar pasta products due to undeclared soy. The products were sold in the 
Swedish Food Market at Ikea stores. 

Source: http://www.fda.gov/Safety/Recalls/ucm416954.htm 

11. October 1, U.S. Food and Drug Administration - (International) Tropical Valley 
Foods issues allergy alert for potentially undeclared peanuts in next by Nature 
Dark Chocolate Cherries. The U.S. Food and Drug Administration announced 
October 1 that Tropical Valley Foods Inc., recalled 455 cases of its next by Nature 
Dark Chocolate Cherries due to undeclared peanuts caused by a packaging error. The 
product was sold in 3-ounce bags and sent in 12 bag cases to distributors and retailers 
in several States, Canada, and Japan. 

Source: http://www.fda.gov/Safety/Recalls/ucm416970.htm 

For another story, see item 7 
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Water and Wastewater Systems Sector 

12. October 2, New Haven Register- (Connecticut) Oil spill cleanup planned at New 
Haven’s former English Station power plant. A plan for environmental cleanup at a 
former power plant in New Haven is underway after oil was discovered in a catch basin 
and in the Mill River by the Connecticut Department of Energy and Environmental 
Protection. Containment and cleanup booms have been placed into the river by the U.S. 
Coast Guard to contain pollutants. 

Source: http://www.nhregister.com/general-news/20141001/oil-spill-cleanup-planned- 
at-new-havens-former-english-station-power-plant 

13. October 2, Longview News-Journal - (Texas) Longview sewage spill cleaned; TCEQ 
to investigate. The Texas Commission on Environmental Quality is investigating after 
crews completed October 1 cleaning up an 80,000 gallon sewage spill that occurred at 
the Grace Creek Wastewater Treatment Plant September 25. 

Source: http://www.news-ioumal.com/news/local/longview-sewage-spill-cleaned-tceq- 
to-investigate/article Id779efa-bf68-5a57-9cdd-269ff0913632.html 

14. October 2, West Virginia American Water Release - (West Virginia) Precautionary 
boil water advisory lifted for customers in Salt Rock. A precautionary boil water 
advisory was lifted for approximately 250 West Virginia American Water residential 
customers in Cabell County October 1 . 

Source: http://www.huntingtonnews.net/96865 

15. October 2, Rutland Herald - (Vermont) Boil-water order continues in Fair Haven. A 
boil water advisory remains in effect for residents in Fair Haven and is expected to 
continue through October 3 after water tested positive for bacterial contamination 
September 25. 

Source: http://www.rutlandherald.com/article/20141002/THISJUSTIN/141009994 
For another story, see item 3 
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Healthcare and Public Health Sector 

16. October 1, Los Angeles Times - (California) Cedars-Sinai says number of patient 
files in data breach much higher. Cedars-Sinai Medical Center in Los Angeles 
notified 33,136 patients September 1 1 that their personal and health information may 
have been accessed after a password-protected, unencrypted laptop was stolen from an 
employee’s home during a June burglary. The hospital previously reported the theft to 
500 patients in August, but forensic analysis determined the laptop contained 
information for thousands of additional patients, including about 1,500 Social Security 
numbers. 
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Source: http://www.latimes .com/business/la-fi-cedars-data-breach-20 141 002- 
story.html 



17. October 1, Securityweek - (International) FDA publishes cybersecurity guidance for 
medical device manufacturers. A set of recommended cybersecurity measures for 
medical device manufacturers was released October 2 by the U.S. Food and Drug 
Administration detailing the importance of authentication controls and detection of 
devices. The report also included guidance on the submission of plans for providing 
updates to operating systems and software, and the creation of a plan to help mitigate 
risks, among other recommendations. 

Source: http://www.securitvweek.com/fda-publishes-cvbersecurity-guidance-medical- 
device-manufacturers 
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Government Facilities Sector 

18. October 2, Connecticut Post - (Connecticut) Sandy Hook evacuated after bomb 
threat. Classes resumed October 2 at Sandy Hook Elementary School’s temporary 
campus in Monroe after a bomb threat prompted the evacuation of students and staff 
October 1. Police searched the building and deemed it safe once nothing suspicious was 
found. 

Source: http://www.ctpost.com/local/article/Sandv-Hook-school-evacuated-after-threat- 
5793903 .php 

19. October 1, Reuters - (National) Six charged with bribery in grant U.S. National 
Guard contracts. Three executives from Arlington, Virginia-based National Guard 
Bureau, Financial Solutions, Inc. of Fredericksburg, and Mil-Team Consulting of 
Minnesota pleaded guilty October 1 in a bribery scheme to grant U.S. National Guard 
contracts incorrectly by bribing National Guard officials with money to award them 
marketing and advertising contracts worth $14.6 million. Three others were also 
charged in the scheme which involved the distribution of federal funds by the National 
Guard Bureau to the Army National Guard and its State units. 

Source: http://www.reuters.com/article/2014/10/01/us-usa-crime-nationalguard- 
idUSKCN0HQ5D020141001 

20. October 1, KAKE 10 Wichita - (Kansas) 7 kids hospitalized following school bus 
accident. An accident involving an Amelia Earhart Elementary School bus left 7 
children and 1 adult injured when the bus drove off the road and into a ditch near 
Wichita October 1. 

Source: http://www.kake.com/home/headlines/Pawnee-school-bus-crash- 
277739531.html 

21. October 1, KSTU 13 Salt Lake City - (Utah) Provo City School District warning 
employees of data breach. The Provo City School District in Utah notified about 
1 ,400 employees that their personal information may have been compromised in a 
phishing attack September 29 that targeted an employee’s email account which 
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contained files of sensitive and personal employee information. The school district 
neutralized the breach and continues to investigate the scope. 

Source: http://foxl3now.corn/2014/10/01/provo-citv-school-district-waming- 
employees-students-of-data-breach/ 

22. October 1, KGBT 4 Harlingen - (Texas) Chemical spill at Moorefield Air Base sends 
1 to hospital. HAZMAT crews spent several hours cleaning up a chemical spill at 
Moorefield Air Base near Alton, Texas, October 1 after 10 to 15 gallons of 
hydrochloric acid spilled causing an evacuation. One person was transported to a local 
hospital as a precaution. 

Source: http://www.vallevcentral.com/news/story.aspx?id=l 103924 

23. October 1, Reuters - (Washington) Teen arrested over string of Washington state 
arson fires. The Spokane County Fire District 8 chief announced October 1 that a 
teenager was arrested in connection to setting 23 fires since September 9 in suburbs 
near Spokane. The suspect admitted to setting the blazes due to his dissatisfaction with 
his family’s recent move to Washington. 

Source: http://www.reuters.com/article/2014/10/02/us-usa-washington-arson- 
idU S KCN0HR07 J20 1 4 1 002 

24. October 1, KPHO 5 Phoenix - (Arizona) 32 light poles in Tempe stripped of copper 
wiring. Authorities are searching for suspects who caused around $15,000 in damage 
by stealing copper wiring from 32 light poles at Tempe Town Lake. Authorities believe 
the theft occurred sometime between September 28 and October 1. 

Source: http://www.kpho.com/story/26682474/32-light-poles-in-tempe-stripped-of- 
copper-wiring 
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Emergency Services Sector 

Nothing to report 
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Information Technology Sector 

25. October 2, Softpedia - (International) Major security flaw in Xen hypervisor 
disclosed. The developers of the Xen hypervisor released a patch after a security 
vulnerability was disclosed October 1 that could allow an attacker to use a malicious 
hardware virtual machine to read data from other virtual machines or crash the host 
machine. 

Source: http://news.softpedia.com/news/Maior-Security-Flaw-in-Xen-Hypervisor- 
Disclosed-46Q746.shtml 

26. October 2, Softpedia - (International) OS X botnet malware uses Reddit to get IPs of 
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control servers. Researchers with Doctor Web found that a piece of botnet malware for 
OS X known as iWorm uses the search function on Reddit to access a list of command 
and control (C&C) servers used to receive instructions. Over 17,000 unique IP 
addresses are associated with systems infected by iWorm and the C&C server addresses 
are disguised on Reddit by purporting to be addresses for Minecraft servers. 

Source: http://news.softpedia.com/news/OS-X-Botnet-Malware-Uses-Reddit-to-Get- 
IPs-of-Control-Servers-460766.shtml 



27. October 2, Securityweek - (International) VMware releases software updates to fix 
ShellShock bug. VMware released patches for several of its products in order to close 
the Shellshock vulnerability in GNU Bash. 

Source: http://www.securityweek.com/vmware-releases-software-updates-fix- 
shellshock-bug 

28. October 2, The Register - (International) Researchers bypass Redmond’s EMET, 
again. Researchers with Offensive Security reported that they were able to bypass the 
fifth version of Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) security 
tool on several versions of the Windows operating system. 

Source: http://www.theregister.co.uk/2014/10/02/researchers bypass redmonds emet 
again/ 

29. October 1, The Register - (International) Bash bug flung against NAS boxes. FireEye 
researchers warned that attackers are attempting to exploit the Shellshock vulnerability 
in GNU Bash in order to compromise Network Attached Storage (NAS) systems before 
the systems can be patched. The researchers reported that NAS systems made by 
QNAP were especially targeted and that attackers were seeking to install backdoors. 
Source: http://www.theregister.co.uk/2014/10/01/sheelshock nas attack/ 

30. October 1, Threatpost - (International) Joomla re-issues security update after 
patches glitch. The developers of Joomla released a second version of a security 
update October 1 after an initial update designed to close critical vulnerabilities created 
some technical issues with users. 

Source: http://threatpost.com/joomla-re-issues-security-update-after-patches-glitch 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert. gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

31. September 30, Kansas City Star - (Missouri) Sprint says its Blue Springs service is 
restored after disruption at one tower. Wireless service to Sprint customers in Blue 
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Springs was restored September 30 after being disrupted September 29. 

Source: http://www.kansascity.com/news/business/technology/article2354752.html 



For another story, see item 3 
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Commercial Facilities Sector 

32. October 2, WEWS 5 Cleveland - (Ohio) Evacuation: Police, fire crews, HAZMAT at 
Stark Co. campgrounds for gas and oil leak. About 100 residents of the Spring wood 
Lake Campgrounds were evacuated for several hours from the Stark County trailer park 
and campground October 2 while crews worked to repair a 20-inch crude/natural gas 
line that leaked about 200 gallons of oil and natural gas onto the ground and into a lake. 
A drinking well near the site of the leak was closed off due to possible contamination. 
Source: http://www.newsnet5.com/news/local-news/oh-stark/police-fire-crews-and- 
hazmat-units-at-the-scene-of-stark-co-campgrounds-for-a-natural-gas-leak 

33. October 2, Softpedia - (International) Data breach on Flinn Scientific server lasted 
for four months. Flinn Scientific officials notified October 2 customers that made at 
least one purchase through its online store since May 2 that their financial information, 
including payment card number and card verification code, may have been 
compromised after malware was planted on the company’s Web based payment 
system. The breach was discovered September 8 and the company removed the 
malicious software from its network. 

Source: http://news.softpedia.com/news/Data-Breach-on-Flinn-Scientific-Server- 
Lasted-for-Four-Months-4607 94 . shtml 

34. October 2, Associated Press - (Indiana) Fire destroys much of Indianapolis church. 
Authorities are investigating an October 2 fire at the Friendly Church of the Nazarene 
in Indianapolis that caused an estimated $300,000 in damage to the structure. 

Source: http://www.foxl9.com/storv/26685028/fire-destrovs-much-of-indianapolis- 
church 

35. October 1, WCBS 2 New York City - (New York) FDNY: 54 workers removed from 
scaffolding after power outage hits Rochdale Village in Jamaica. An October 1 
power outage at a privately owned power plant at the Rochdale Village housing 
complex in the Jamaica, Queens area of New York City stranded about 25 people in 
elevators and 54 workers on construction scaffolding, and prompted an evacuation of 
residents from about 20 buildings in the complex. Four individuals were injured during 
the incident and power was restored to the complex after more than 3 hours. 

Source: http://newyork.cbslocal.com/2Q14/10/01/power-outage-hits-numerous- 
buildings-at-rochdale-village-in-jamaica-queens/ 



36. October 1, Associated Press - (Indiana) 2 critically injured in apartment explosion, 
fire. Officials are investigating a possible gas leak after two residents of an apartment 
complex in Cumberland were critically injured October 1 by an explosion sparked 
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when the individuals lit their stove to cook. The building suffered a partial roof collapse 
and at least four units were affected, causing an estimated $250,000 in damage. 

Source: http://www.whio.com/ap/ap/indiana/2-criticallv-iniured-in-apartment- 
explosion-fire/nhZJ 8/ 

37. September 30, WKRN 2 Nashville - (Tennessee) Suspicious package in Manchester 
turns out to be part of game. Several businesses in Manchester, Tennessee, were 
evacuated and closed for about 5 hours September 29 while authorities investigated 
reports of man who placed a suspicious package near gas lines behind a restaurant. 
Officials cleared the scene after they determined the device to be a geocaching 
apparatus used for a game. 

Source: http://www.wkrn.com/story/26659425/after-manchester-restaurant-evacuated- 
suspicious-package-deemed-safe 
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Dams Sector 



38. October 1, Valley Breeze - (Rhode Island) Reconstruction work at Georgiaville Dam 
complete. Officials announced October 1 that the $475,000 reconstruction work at the 
Georgiaville Pond Dam in Smithfield was completed. The reconstruction work 
included the demolition of a previous spillway, removal of existing gate controls from 
the outlet structure, and the construction of a new spillway, gate control structure, and 
gatehouse. 

Source: http ://w w w . valleybreeze .com/20 14-1 0-0 1 /observer-smithfield- 
west/reconstruction-work-georgiaville-dam-complete#.VClxwPldVxY 
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